Improper Handling of Case Sensitivity

Every one of the 135 is a mark on the map. Named now: 1 to 26, most at risk first.

1. WordPress SP Project & Document Manager <4.22 - Authenticated Shell UploadCVE-2021-24347Smartypantsplugins · 54% likely

   Smartypantsplugins

2. Etherpad Lite <1.6.4 - Admin Authentication BypassCVE-2018-9845Etherpad · 13% likely

   Etherpad

3. FreeScout < 1.8.224 - Invite Hash Authorization BypassCVE-2026-53595freescout-help-desk · CVSS 9.4 · 1.9% likely

   Freescout-Help-Desk

4. Apache Camel: Camel Message Header Injection via Improper FilteringCVE-2025-27636Apache Software Foundation · CVSS 5.6 · 97% likely

   Apache

5. Sun ONE Application Server 7.0 for Windows 2000/XP allows remote attackers to obtain JSP source code via a request that uses the uppercase ".JSP" extension instead of the lowercas…CVE-2003-041125% likely
6. Apache Camel: Camel-CXF Message Header Injection via Missing Inbound FilteringCVE-2026-47323Apache Software Foundation · CVSS 9.8 · 20% likely

   Apache

7. Apache on MacOS X Client 10.0.3 with the HFS+ file system allows remote attackers to bypass access restrictions via a URL that contains some characters whose case is not matched b…CVE-2001-07668.9% likely
8. Netscape FastTrack Web server lists files when a lowercase "get" command is used instead of an uppercase GET.CVE-1999-02397.6% likely
9. MyServer 0.8.9 and earlier does not properly handle uppercase characters in filename extensions, which allows remote attackers to obtain sensitive information (script source code)…CVE-2007-33656.0% likely
10. In Spring Framework versions 5.3.0 - 5.3.18, 5.2.0 - 5.2.20, and older unsupported versions, the patterns for disallowedFields on a DataBinder are case sensitive which means a fie…CVE-2022-22968Vmware · 5.7% likely

    VMware

11. Windows DNS Information Disclosure VulnerabilityCVE-2021-28323Microsoft · CVSS 6.5 · 4.6% likely

    Microsoft

12. OWASP CRS: Whitespace padding in filenames bypasses file upload extension checksCVE-2026-33691coreruleset · CVSS 6.8 · 3.8% likely
13. Apache Tomcat: Security constraint bypass for CGI scriptsCVE-2025-46701Apache Software Foundation · CVSS 7.3 · 3.1% likely

    Apache

14. IBM WebSphere server 3.0.2 allows a remote attacker to view source code of a JSP program by requesting a URL which provides the JSP extension in upper case.CVE-2000-04973.1% likely
15. Mbedthis AppWeb HTTP server before 1.1.3 allows remote attackers to bypass access restrictions via a URI with mixed case characters.CVE-2004-22142.7% likely
16. Novell eDirectory 8.6.2 and 8.7 use case insensitive passwords, which makes it easier for remote attackers to conduct brute force password guessing.CVE-2002-21192.7% likely
17. The file extension check in GNUBoard 3.40 and earlier only verifies extensions that contain all lowercase letters, which allows remote attackers to upload arbitrary files via file…CVE-2005-02692.6% likely
18. The default configuration of BEA WebLogic 3.1.8 through 4.5.1 allows a remote attacker to view source code of a JSP program by requesting a URL which provides the JSP extension in…CVE-2000-04992.5% likely
19. Chamilo LMS Htaccess File Upload Security BypassCVE-2023-3545Chamilo · CVSS 9.8 · 2.4% likely

    Chamilo

20. register.php in Ultimate PHP Board (UPB) 1.0 and 1.0b uses an administrative account Admin with a capital "A," but allows a remote attacker to impersonate the administrator by reg…CVE-2002-18202.4% likely
21. Unify eWave ServletExec allows a remote attacker to view source code of a JSP program by requesting a URL which provides the JSP extension in upper case.CVE-2000-04982.3% likely
22. Apache Camel JMS, Apache Camel CoAP, Apache Camel Google PubSub: Incomplete fix for CVE-2025-27636 in non-HTTP HeaderFilterStrategies (camel-jms, camel-sjms, camel-coap, camel-goo…CVE-2026-40453Apache Software Foundation · CVSS 9.9 · 2.1% likely

    Apache

23. CUPS before 1.1.21rc1 treats a Location directive in cupsd.conf as case sensitive, which allows attackers to bypass intended ACLs via a printer name containing uppercase or lowerc…CVE-2004-2154CVSS 9.8 · 2.1% likely
24. Perception LiteServe 1.25 allows remote attackers to obtain source code of CGI scripts via URLs that contain MS-DOS conventions such as (1) upper case letters or (2) 8.3 file name…CVE-2001-07952.0% likely
25. uploads/include/dialog/select_soft.php in DedeCMS V57_UTF8_SP2 allows remote attackers to execute arbitrary PHP code by uploading with a safe file extension and then renaming with…CVE-2019-6289Dedecms · 1.9% likely

    Dedecms

26. Apache for Apple Mac OS X 10.2.8 and 10.3.6 restricts access to files in a case sensitive manner, but the Apple HFS+ filesystem accesses files in a case insensitive manner, which…CVE-2004-10831.9% likely

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.